# Gate record — releases#331 H2 (bundle release side, #338), PR #254 @ `c185326b`

Gater: doyle, 2026-09-24 11:40Z, HFENDULEAM.
Lane: hertz. Base `b4490c4f` (my PR #253 landed 11:04Z). Branch `feat/338-bundle-release-side`.

## Subject verified before any green was read

- Head `c185326bd2b08e152cc33aa975fcea2240ca1cc8`; `git merge-base --is-ancestor origin/main
  c185326b` true against `origin/main = b4490c4f` — a true fast-forward, tested sha == merged sha.
- Five commits: `4c33c983` (release-side gate, red on purpose) / `7b28df47` (xtask
  `bundle-adapters` + `release-publish` signs) / `ac754801` (peer_rig `SetBuilder.bundle`) /
  `10ed32be` (tar call independent of image-search order — **a refactor, NOT a bugfix**;
  see the withdrawn defect below) / `c185326b` (my IR-147 rider).
- The first three patch-ids are identical to hertz's pre-rebase chain (`b6c775a0` / `582a7b2f` /
  `b2ad4a30`), and `16b44a46`->`ac754801` differed by exactly my docs +7. His reported numbers
  therefore measure the gated tree.

## Conditions

| # | condition | verdict | evidence |
|---|---|---|---|
| 1 | CI green on the gated sha | HOLDS | run `35992242546` on `c185326b`, 5/5: changes, traceability, lint, unit Linux (kitsubito), unit Windows (hfenduleam) |
| 2 | traceable-reqs clean | HOLDS | traceability job success at `c185326b`; hertz's run EXIT=0, 950/950 complete, 0 findings, headers==ids 950, checker 0.4.1. New `REQ-BUNDLE-RELEASE-ASSET` activated doc/impl/unit, int deferred to W5 |
| 3 | code read: gate + verifier + units correct and correctly tagged | HOLDS | `require_bundle`, `verify_update_set_bundle`, both unit tests read by doyle; tags sit on the evidence |
| 4 | **the bundle actually assembles, live** | HOLDS — doyle measured | see below |
| 5 | **the two int binaries CI skips execute green** | HOLDS — doyle measured | see below |

## Leg 1 — live assembly (doyle, in `.worktrees/gate-ac754801` @ `c185326b`)

`cargo run -p xtask -- bundle-adapters --out <tmp>\spt-bundled-adapters.tar.gz` exit 0, archive
sha256 `854067c06756fa43aa3d8a30b812cf5f732f8a3eccc4dbd9725c0c564ee6071d`.

Verified against the ARTIFACT, not the tool's stdout — extracted and recomputed both hashes:

| member | version | source | bytes | sha256 (recomputed from extracted bytes) |
|---|---|---|---|---|
| claude-spt | 0.41.3 | BigscreenVR/claude-spt-bs | 1546835 | `b502d355cc5f73b417d34dc77159936fdac316650690d1226b74992452fc0394` |
| PACER | 0.7.0 | BigscreenVR/spt-pacer-tool | 1094942 | `cbf88d6a062ed0fe784dcc89cbd520c0e5011eefa5f248e6048c8eef653d1b2a` |

Both match `bundle.json`'s `sha256` fields exactly, and `bundle.json`'s `name`/`version` pairs are
the two expected adapters and nothing else.

Tar member names, verbatim: `./`, `./bundle.json`, `./claude-spt.spt`, `./PACER.spt` — the `./`
prefix re-measured here, which is carry-forward (b) below.

## Leg 2 — the two int binaries CI skips (doyle, same worktree, box idle)

CI's unit leg filters `kind(lib) + kind(bin)`, so `tests/` integration binaries are built and
skipped (the H3 blind spot). Run under my own hand with `--success-output immediate`:

- `cargo nextest run -p spt --test peer_rig_selftest --success-output immediate` — **9 tests run:
  9 passed, 0 skipped** in 2.830s, exit 0. Named arms read, including
  `bundle_round_trips_members_byte_identical`,
  `set_bundle_entry_matches_the_mock_bundle_asset_and_nothing_else`,
  `signed_mock_adapter_archive_verifies_and_a_flipped_byte_does_not`,
  `inproc_pull_stages_at_a_rostered_peer_and_not_at_an_unrostered_one`.
- `cargo nextest run -p spt --test peer_docs_e2e --success-output immediate` — **2 tests run:
  2 passed, 0 skipped** in 3.902s, exit 0, including
  `a_peer_pulled_set_lands_the_peers_version_matched_docs`.

This closes, at this sha, the H3 record's condition 5 blind spot for `peer_rig_selftest`: the rig
now has an execution measurement from the gate, not only builder testimony. It remains true that
CI itself never runs these binaries — first CI execution is still the #331 golden.

Run scheduling: legs were sequenced against the box, not fired into it. The pool-claim build and
leg 1 (load-insensitive) ran capped at `-j 6` while the Windows unit held this runner; leg 2 (the
timing-sensitive rigs) waited for CI to complete. Pool claimed as lane `gate-H2-c185326b`.

## A defect I raised and WITHDREW — do not re-derive it

I measured that Git Bash resolves `tar` to GNU 1.35, which dies on an absolute Windows path
("Cannot connect to C: resolve failed"), and claimed `release-publish` could not publish from Bash.
**Wrong subject.** A rustc probe doing `Command::new("tar")` launched from Git Bash prints bsdtar
3.8.4 — Windows searches System32 before PATH, so a shell PATH probe does not measure what the
program spawns. hertz disputed it with his own live run and was right. Written up as memory
`shell-path-probe-does-not-measure-a-spawned-tool`.

Residual that IS real: bsdtar REJECTS `--force-local`, so that flag is never the portable fix.
hertz kept the relative-path shape in `10ed32be` as a refactor, pinned by
`tar_plan_never_passes_a_drive_letter`, and the commit says explicitly it is not a bugfix.

## Carried forward to W5 (#338 apply side) — both from source read, NEITHER measured

- **(a)** `verify_update_set_bundle` returns `Err` on a set with NO bundle entry, and
  `debug_rollout_meta` sets `bundle: None`. The apply side must read "no entry" as "nothing to
  apply", NEVER as a set rejection — otherwise every set published through v0.72.0 and every debug
  rollout becomes unappliable.
- **(b)** Bundle members carry a `./` tar prefix (re-measured in leg 1 above), so the reader must
  not match bare names.

## IR-147 rider

`c185326b` carries the IR-147 entry: a docs-only PR skips unit, so its merge finds no successful
unit to reuse (`UNIT_REUSE run-unit=true reason=both-unit-jobs-not-successful`) and pays a full
Windows+Linux unit on a Markdown commit — measured landing #253. My first fix candidate said
"diff `HEAD^1..HEAD`", which is WRONG for a multi-commit ff push (`HEAD^1` lands inside the lane);
the entry now says `github.event.before..github.sha`. hertz swapped the stale rider for the
corrected `e5684ecb`, verified in the pushed tree.

## Verdict

**GATE PASSES.** ff-land `c185326b` onto main. Every condition is measured at the gated sha; the
two conditions H3 had to hold as testimony (assembly, rig execution) are doyle measurements here.